1 Release Notes for BIND Version
|
|
- Sophie Lucinda Mosley
- 5 years ago
- Views:
Transcription
1 1 Release Notes for BIND Version Introduction BIND 9.13 is an unstable development release of BIND. This document summarizes new features and functional changes that have been introduced on this branch. With each development release leading up to the stable BIND 9.14 release, this document will be updated with additional features added and bugs fixed. 1.2 Note on Version Numbering Prior to BIND 9.13, new feature development releases were tagged as "alpha" and "beta", leading up to the first stable release for a given development branch, which always ended in ".0". Now, however, BIND has adopted the "odd-unstable/even-stable" release numbering convention. There will be no "alpha" or "beta" releases in the 9.13 branch, only increasing version numbers. So, for example, what would previously have been called a1, a2, b1, and so on, will instead be called , , , etc. The first stable release from this development branch will be renamed as Thereafter, maintenance releases will continue on the 9.14 branch, while unstable feature development proceeds in Supported Platforms BIND 9.13 has undergone substantial code refactoring and cleanup, and some very old code has been removed that was needed to support legacy platforms which are no longer supported by their vendors and for which ISC is no longer able to perform quality assurance testing. Specifically, workarounds for old versions of UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been removed. On UNIX-like systems, BIND now requires support for POSIX.1c threads (IEEE Std c-1995), the Advanced Sockets API for IPv6 (RFC 3542), and standard atomic operations provided by the C compiler. More information can be found in the PLATFORM.md file that is included in the source distribution of BIND 9. If your platform compiler and system libraries provide the above features, BIND 9 should compile and run. If that isn t the case, the BIND development team will generally accept patches that add support for systems that are still supported by their respective vendors. As of BIND 9.13, the BIND development team has also made cryptography (i.e., TSIG and DNSSEC) an integral part of the DNS server. The OpenSSL cryptography library must be available for the target platform. A PKCS#11 provider can be used instead for Public Key cryptography (i.e., DNSSEC signing and validation), but OpenSSL is still required for general cryptography operations such as hashing and random number generation. 1.4 Download The latest versions of BIND 9 software can always be found at There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. 1.5 Security Fixes There was a long-existing flaw in the documentation for ms-self, krb5-self, ms-subdomain, and krb5-subdomain rules in update-policy statements. Though the policies worked as intended, operators who configured their servers according to the misleading documentation may have thought zone updates were more restricted than they were; users of these rule types are advised to review the documentation and correct their configurations if necessary. New rule types matching the previously documented behavior will be introduced in a future maintenance release. [GL!708] When recursion is enabled but the allow-recursion and allow-query-cache ACLs are not specified, they should be limited to local networks, but they were inadvertently set to match the default allow-query, thus allowing remote queries. This flaw is disclosed in CVE [GL #309] named could crash during recursive processing of DNAME records when deny-answer-aliases was in use. This flaw is disclosed in CVE [GL #387] 1
2 Code change #4964, intended to prevent double signatures when deleting an inactive zone DNSKEY in some situations, introduced a new problem during zone processing in which some delegation glue RRsets are incorrectly identified as needing RRSIGs, which are then created for them using the current active ZSK for the zone. In some, but not all cases, the newly-signed RRsets are added to the zone s NSEC/NSEC3 chain, but incompletely -- this can result in a broken chain, affecting validation of proof of nonexistence for records in the zone. [GL #771] 1.6 New Features Task manager and socket code have been substantially modified. The manager uses per-cpu queues for tasks and network stack runs multiple event loops in CPU-affinitive threads. This greatly improves performance on large systems, especially when using multi-queue NICs. A new secondary zone option, mirror, enables named to serve a transferred copy of a zone s contents without acting as an authority for the zone. A zone must be fully validated against an active trust anchor before it can be used as a mirror zone. DNS responses from mirror zones do not set the AA bit ("authoritative answer"), but do set the AD bit ("authenticated data"). This feature is meant to facilitate deployment of a local copy of the root zone, as described in RFC [GL #33] A new plugin mechanism has been added to allow extension of query processing functionality through the use of external libraries. The new filter-aaaa.so plugin replaces the filter-aaaa feature that was formerly implemented as a native part of BIND. The plugin API is a work in progress and is likely to evolve as further plugins are implemented. [GL #15] BIND now can be compiled against the libidn2 library to add IDNA2008 support. Previously, BIND supported IDNA2003 using the (now obsolete and unsupported) idnkit-1 library. named now supports the "root key sentinel" mechanism. This enables validating resolvers to indicate which trust anchors are configured for the root, so that information about root key rollover status can be gathered. To disable this feature, add root-key-sentinel no; to named.conf. [GL #37] The dnskey-sig-validity option allows the sig-validity-interval to be overriden for signatures covering DNSKEY RRsets. [GL #145] Support for QNAME minimization was added and enabled by default in relaxed mode, in which BIND will fall back to normal resolution if the remote server returns something unexpected during the query minimization process. This default setting might change to strict in the future. When built on Linux, BIND now requires the libcap library to set process privileges. The adds a new compile-time dependency, which can be met on most Linux platforms by installing the libcap-dev or libcap-devel package. BIND can also be built without capability support by using configure --disable-linux-caps, at the cost of some loss of security. The validate-except option specifies a list of domains beneath which DNSSEC validation should not be performed, regardless of whether a trust anchor has been configured above them. [GL #237] Two new update policy rule types have been added krb5-selfsub and ms-selfsub which allow machines with Kerberos principals to update the name space at or below the machine names identified in the respective principals. The new configure option --enable-fips-mode can be used to make BIND enable and enforce FIPS mode in the OpenSSL library. When compiled with such option the BIND will refuse to run if FIPS mode can t be enabled, thus this option must be only enabled for the systems where FIPS mode is available. Two new configuration options min-cache-ttl and min-ncache-ttl has been added to allow the BIND 9 administrator to override the minimum TTL in the received DNS records (positive caching) and for storing the information about non-existent records (negative caching). The configured minimum TTL for both configuration options cannot exceed 90 seconds. 2
3 1.7 Removed Features Workarounds for servers that misbehave when queried with EDNS have been removed, because these broken servers and the workarounds for their noncompliance cause unnecessary delays, increase code complexity, and prevent deployment of new DNS features. See for further details. In particular, resolution will no longer fall back to plain DNS when there was no response from an authoritative server. This will cause some domains to become non-resolvable without manual intervention. In these cases, resolution can be restored by adding server clauses for the offending servers, specifying edns no or send-cookie no, depending on the specific noncompliance. To determine which server clause to use, run the following commands to send queries to the authoritative servers for the broken domain: dig soa +dnssec dig soa +dnssec +nocookie dig soa +noedns If the first command fails but the second succeeds, the server most likely needs send-cookie no. If the first two fail but the third succeeds, then the server needs EDNS to be fully disabled with edns no. Please contact the administrators of noncompliant domains and encourage them to upgrade their broken DNS servers. [GL #150] Previously, it was possible to build BIND without thread support for old architectures and systems without threads support. BIND now requires threading support (either POSIX or Windows) from the operating system, and it cannot be built without threads. The filter-aaaa, filter-aaaa-on-v4, and filter-aaaa-on-v6 options have been removed from named, and can no longer be configured using native named.conf syntax. However, loading the new filter-aaaa.so plugin and setting its parameters provides identical functionality. named can no longer use the EDNS CLIENT-SUBNET option for view selection. In its existing form, the authoritative ECS feature was not fully RFC-compliant, and could not realistically have been deployed in production for an authoritative server; its only practical use was for testing and experimentation. In the interest of code simplification, this feature has now been removed. The ECS option is still supported in dig and mdig via the +subnet argument, and can be parsed and logged when received by named, but it is no longer used for ACL processing. The geoip-useecs option is now obsolete; a warning will be logged if it is used in named.conf. ecs tags in an ACL definition are also obsolete, and will cause the configuration to fail to load if they are used. [GL #32] dnssec-keygen can no longer generate HMAC keys for TSIG authentication. Use tsig-keygen to generate these keys. [RT #46404] Support for OpenSSL 0.9.x has been removed. OpenSSL version or greater, or LibreSSL is now required. The configure --enable-seccomp option, which formerly turned on system-call filtering on Linux, has been removed. [GL #93] IPv4 addresses in forms other than dotted-quad are no longer accepted in master files. [GL #13] [GL #56] IDNA2003 support via (bundled) idnkit-1.0 has been removed. The "rbtdb64" database implementation (a parallel implementation of "rbt") has been removed. [GL #217] The -r randomdev option to explicitly select random device has been removed from the ddnsconfgen, rndc-confgen, nsupdate, dnssec-confgen, and dnssec-signzone commands. The -p option to use pseudo-random data has been removed from the dnssec-signzone command. 3
4 Support for ECC-GOST (GOST R ) algorithm has been removed from BIND as the algorithm has been superseded by GOST R in RFC6986 and it must not be used in new deployments. BIND will neither create new DNSSEC keys, signatures and digest, nor it will validate them. Add the ability to not return a DNS COOKIE option when one is present in the request. To prevent a cookie being returned add answer-cookie no; to named.conf. [GL #173] answer-cookie is only intended as a temporary measure, for use when named shares an IP address with other servers that do not yet support DNS COOKIE. A mismatch between servers on the same address is not expected to cause operational problems, but the option to disable COOKIE responses so that all servers have the same behavior is provided out of an abundance of caution. DNS COOKIE is an important security mechanism, and should not be disabled unless absolutely necessary. Remove support for silently ignoring no-change deltas from BIND 8 when processing an IXFR stream. no-change deltas will now trigger a fallback to AXFR as the recovery mechanism. BIND 9 will no longer build on platforms that doesn t have proper IPv6 support. BIND 9 now also requires non-broken POSIX-compatible pthread support. Such platforms are usually long after their end-of-life date and they are neither developed nor supported by their respective vendors. Support for DSA and DSA-NSEC3-SHA1 algorithms has been removed from BIND as the DSA key length is limited to 1024 bits and this is not considered secure enough. 1.8 Feature Changes BIND will now always use the best CSPRNG (cryptographically-secure pseudo-random number generator) available on the platform where it is compiled. It will use arc4random() family of functions on BSD operating systems, getrandom() on Linux and Solaris, CryptGenRandom on Windows, and the selected cryptography provider library (OpenSSL or PKCS#11) as the last resort. [GL #221] The default setting for dnssec-validation is now auto, which activates DNSSEC validation using the IANA root key. (The default can be changed back to yes, which activates DNSSEC validation only when keys are explicitly configured in named.conf, by building BIND with configure -- disable-auto-validation.) [GL #30] BIND can no longer be built without DNSSEC support. A cryptography provider (i.e., OpenSSL or a hardware service module with PKCS#11 support) must be available. [GL #244] Zone types primary and secondary are now available as synonyms for master and slave, respectively, in named.conf. named will now log a warning if the old root DNSSEC key is explicitly configured and has not been updated. [RT #43670] dig +nssearch will now list name servers that have timed out, in addition to those that respond. [GL #64] Up to 64 response-policy zones are now supported by default; previously the limit was 32. [GL #123] Several configuration options for time periods can now use TTL value suffixes (for example, 2h or 1d) in addition to an integer number of seconds. These include fstrm-set-reopen-interval, interface-interval, max-cache-ttl, max-ncache-ttl, max-policy-ttl, and min-update-interval. [GL #203] NSID logging (enabled by the request-nsid option) now has its own nsid category, instead of using the resolver category. The rndc nta command could not differentiate between views of the same name but different class; this has been corrected with the addition of a -class option. [GL #105] 4
5 allow-recursion-on and allow-query-cache-on each now default to the other if only one of them is set, in order to be consistent with the way allow-recursion and allow-query-cache work. [GL #319] When compiled with IDN support, the dig and nslookup commands now disable IDN processing when the standard output is not a TTY (i.e., when the output is not being read by a human). When running from a shell script, the command line options +idnin and +idnout may be used to enable IDN processing of input and output domain names, respectively. When running on a TTY, the +noidnin and +noidnout options may be used to disable IDN processing of input and output domain names. The configuration option max-ncache-ttl cannot exceed seven days. Previously, larger values than this were silently lowered; now, they trigger a configuration error. The new dig -r command line option disables reading of the file $HOME/.digrc. 1.9 Bug Fixes Running rndc reconfig could cause inline-signing zones to stop signing. [GL #439] Reloading all zones caused zone maintenance to stop for inline-signing zones. [GL #435] Signatures loaded from the journal for the signed version of an inline-signing zone were not scheduled for refresh. [GL #482] A referral response with a non-empty ANSWER section was incorrectly treated as an error; this caused certain domains to be non-resolvable. [GL #390] When a negative trust anchor was added to multiple views using rndc nta, the text returned via rndc was incorrectly truncated after the first line, making it appear that only one NTA had been added. This has been fixed. [GL #105] The view name is now included in the output of rndc nta -dump, for consistency with other options. [GL!816] named now rejects excessively large incremental (IXFR) zone transfers in order to prevent possible corruption of journal files which could cause named to abort when loading zones. [GL #339] 1.10 License BIND is open source software licenced under the terms of the Mozilla Public License, version 2.0 (see the LICENSE file for the full text). The license requires that if you make changes to BIND and distribute them outside your organization, those changes must be published under the same license. It does not require that you publish or disclose anything other than the changes you have made to our software. This requirement does not affect anyone who is using BIND, with or without modifications, without redistributing it, nor anyone redistributing BIND without changes. Those wishing to discuss license compliance may contact ISC at End of Life BIND 9.13 is an unstable development branch. When its development is complete, it will be renamed to BIND 9.14, which will be a stable branch. The end of life date for BIND 9.14 has not yet been determined. For those needing long term support, the current Extended Support Version (ESV) is BIND 9.11, which will be supported until at least December See for details of ISC s software support policy Thank You Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at 5
1 Release Notes for BIND Version
1 Release Notes for BIND Version 9.12.0 1.1 Introduction BIND 9.12.0 is a new feature release of BIND. This document summarizes new features and functional changes that have been introduced on this branch,
More information1 Release Notes for BIND Version b2
1 Release Notes for BIND Version 9.12.0b2 1.1 Introduction BIND 9.12.0 is a new feature release of BIND, still under development. This document summarizes new features and functional changes that have
More information1 Release Notes for BIND Version b1
1 Release Notes for BIND Version 9.12.0b1 1.1 Introduction BIND 9.12.0 is a new feature release of BIND, still under development. This document summarizes new features and functional changes that have
More informationDNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
More informationDNSSEC for Humans and BIND 10. Paul Vixie Internet Systems Consortium June 9, 2011
DNSSEC for Humans and BIND 10 Paul Vixie Internet Systems Consortium June 9, 2011 Agenda BIND and DNSSEC Why do I want DNSSEC? Why DNSSEC for Humans? BIND 9.7 Features More DNSSEC for Humans Why BIND 10?
More informationHoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
More informationNetwork Working Group
Network Working Group R. Arends Request for Comments: 4035 Telematica Instituut Obsoletes: 2535, 3008, 3090, 3445, 3655, 3658, R. Austein 3755, 3757, 3845 ISC Updates: 1034, 1035, 2136, 2181, 2308, 3225,
More informationExpires: June 16, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003
DNS Extensions Internet-Draft Expires: June 16, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003 Protocol Modifications for the DNS
More informationRoot Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
More informationBy Paul Wouters
By Paul Wouters Overview presentation Theory of DNSSEC Using bind with DNSSEC Securing Ò.nlÓ with SECREG Securing Ò.orgÓ with VerisignLabs Deploying DNSSEC on large scale Audience participation
More informationAn Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
More informationExpires: November 15, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004
DNS Extensions Internet-Draft Expires: November 15, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004 Protocol Modifications for the DNS
More informationSecured Dynamic Updates
Secured Dynamic Updates Caution Portions of this slide set present features that do not appear in BIND until BIND 9.3 Snapshot code is available for this BIND 9.2 can perform most of the dynamic update
More informationDocumentation. Name Server Predelegation Check
Name Server Predelegation Check Doc. version: 1.4.1 Doc. status: Final Doc. date: 01.12.2015 Doc. name: Name Server Predelegation Check- -DNS Services-V1.4.1-2015-12-01 Copyright 2015 DENIC eg Imprint
More informationManaging Authoritative DNS Server
This chapter explains how to set the Authoritative DNS server parameters. Before you proceed with the tasks in this chapter, read Managing Zones which explains how to set up the basic properties of a primary
More informationDNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
More informationDNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
More informationDNSSEC operational experiences and recommendations. Antti Ristimäki, CSC/Funet
DNSSEC operational experiences and recommendations Antti Ristimäki, CSC/Funet Agenda Funet DNSSEC status A short DNSSEC tutorial Zone signing considerations Private key security Network layer impacts Monitoring
More informationDNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
More informationA Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
More informationNetwork Working Group Request for Comments: 5155 Category: Standards Track Nominet D. Blacka VeriSign, Inc. March 2008
Network Working Group Request for Comments: 5155 Category: Standards Track B. Laurie G. Sisson R. Arends Nominet D. Blacka VeriSign, Inc. March 2008 DNS Security (DNSSEC) Hashed Authenticated Denial of
More informationToward Unspoofable Network Identifiers. CS 585 Fall 2009
Toward Unspoofable Network Identifiers CS 585 Fall 2009 The Problem DNS Spoofing Attacks (e.g., Kaminsky) At link (Ethernet) and IP layers, either: Software sets the source address in the packet, or Software
More informationBIND-USERS and Other Debugging Experiences. Mark Andrews Internet Systems Consortium
BIND-USERS and Other Debugging Experiences Mark Andrews Internet Systems Consortium Mark_Andrews@isc.org http://isc.org BIND-USERS and Other Debugging Experiences We will look at some typical debugging
More informationCNAME-based Redirection Design Notes
CNAME-based Redirection Design Notes When we configure a redirect type of local-zone or access-control action, we might want to specify a CNAME as the action data, whose canonical name is managed by an
More informationScott Rose, NIST Winter JointTechs Meeting Jan 30, 2011 Clemson University
Scott Rose, NIST scottr@nist.gov 2011 Winter JointTechs Meeting Jan 30, 2011 Clemson University Special Thanks to RIPE NCC who provided the base slides for this tutorial. DNS is not secure Known vulnerabilities
More informationHands-on DNSSEC with DNSViz. Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016
Hands-on DNSSEC with DNSViz Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016 Preparation Demo and exercises available at: http://dnsviz.net/demo/ Includes links to the following: VirtualBox
More information22/06/ :37 DNS COMPLIANCE. Fred Baker Internet Systems Consortium
DNS COMPLIANCE Fred Baker Internet Systems Consortium Background - 2014 ISC was in the process of adding DNS COOKIE (RFC 7873) to BIND and we wanted to see how many servers would mishandle DNS COOKIE options
More informationBIND 9 Administrator Reference Manual. BIND Version P3
BIND 9 Administrator Reference Manual BIND Version 9.10.2-P3 Copyright c 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015 Internet Systems Consortium, Inc. ( ISC ) Copyright c 2000,
More informationDNSSEC for ISPs workshop João Damas
DNSSEC for ISPs workshop João Damas (joao@isc.org) 1 Outline of workshop Brief intro to DNSSEC Overview of zone signing DNSSEC validation trust anchors validation impact of enabling validation debugging
More informationMonitoring DNSSEC. Martin Leucht Julien Nyczak Supervisor: Rick van Rein
Monitoring DNSSEC Martin Leucht Julien Nyczak Supervisor: Rick van Rein System and Network Engineering 2015 Introduction DNSSEC becomes more and more popular
More informationInternet-Draft Intended status: Experimental March 28, 2014 Expires: September 29, 2014
Network Working Group M. Andrews Internet-Draft ISC Intended status: Experimental March 28, 2014 Expires: September 29, 2014 Abstract EDNS EXPIRE OPTION draft-andrews-dnsext-expire-04 This document specifies
More informationSecuring Domain Name Resolution with DNSSEC
White Paper Securing Domain Name Resolution with DNSSEC diamondip.com by Timothy Rooney Product management director BT Diamond IP Resolution with DNSSEC Introduction By Tim Rooney, Director, Product Management
More informationManaging Caching DNS Server
This chapter explains how to set the Caching DNS server parameters. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which explains the basics of DNS. Configuring
More informationInternet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice ISSN: January 2019
Internet Engineering Task Force (IETF) P. Hoffman Request for Comments: 8499 ICANN BCP: 219 A. Sullivan Obsoletes: 7719 Updates: 2308 K. Fujiwara Category: Best Current Practice JPRS ISSN: 2070-1721 January
More informationDomain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot September 2010 Bengt Sahlin 2011/09/27 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
More informationDNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 DNSSEC 2 2 DNS: Data Flow Zone administrator
More informationARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
More informationA paper on DNSSEC - NSEC3 with Opt-Out
A paper on DNSSEC - NSEC3 with Opt-Out DNSSEC A Way Forward for TLD Registries Method for faster adoption of DNSSEC Providing greater security with minimal impact on customers, registries and Zone Management
More informationTSIGKILL: Bypassing dynamic DNS updates authentication through signature forgery
TSIGKILL: Bypassing dynamic DNS updates authentication through signature forgery or a tale on how to audit a DNS server when you don t really know anything about DNS Date 17/11/2017 GreHack By Clément
More informationDNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION Peter R. Egli 1/10 Contents 1. Security Problems of DNS 2. Solutions for securing DNS 3. Security with DNSSEC
More informationManaging DNS Firewall
, page 1 DNS firewall controls the domain names, IP addresses, and name servers that are allowed to function on the network. This enables Internet Service Providers (ISP), enterprises, or organizations
More informationSOFTWARE USER MANUAL (SUM): TRAINING, PROCEDURAL, AND DEVELOPMENT DOCUMENTATION
SOFTWARE USER MANUAL (SUM): TRAINING, PROCEDURAL, AND DEVELOPMENT DOCUMENTATION Step-by-Step DNS Security Operator Guidance Document (Version 1.0) [Using the BIND-9.3.0 (or later) distribution] 1 December
More informationMCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration. Chapter 5 Introduction to DNS in Windows Server 2008
MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration Chapter 5 Introduction to DNS in Windows Server 2008 Objectives Discuss the basics of the Domain Name System (DNS) and its
More informationLab 6 Implementing DNSSEC
Lab 6 Implementing DNSSEC Objective: Deploy DNSSEC-signed zones. Background DNSSEC (or DNS Security Extensions) provide security to the zone files. Note: In the steps below, we are using myzone.net - our
More informationDomain Name System (DNS)
Domain Name System (DNS) Computer Networks Lecture 9 http://goo.gl/pze5o8 Domain Name System Naming service used in the Internet Accomplishes mapping of logical ("domain") names to IP addresses (and other
More informationCIA Lab Assignment: Domain Name System (1)
CIA Lab Assignment: Domain Name System (1) A. Bakker N. Sijm J. van der Ham M. Pouw Feedback deadline: September 22, 2015 10:00 CET Abstract The Domain Name System (DNS) is a hierarchical, distributed
More informationDNSSEC. Lutz Donnerhacke. db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec e164.arpa. naptr
DNSSEC Lutz Donnerhacke db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec 1.6.5.3.7.5.1.4.6.3.9.4.e164.arpa. naptr 1 A protocol from better times An ancient protocol People were friendly and
More informationDEPLOY A DNS SERVER IN A SECURE WAY
DEPLOY A DNS SERVER IN A SECURE WAY BIND (Berkeley Internet Name Domain) is one of the more widely used DNS servers. This article guides readers on how to deploy a BIND DNS server in a secure way by implementing
More informationWhat's so hard about DNSSEC? Paul Ebersman May 2016 RIPE72 Copenhagen
What's so hard about DNSSEC? Paul Ebersman Paul_Ebersman@cable.comcast.com 23-27 May 2016 RIPE72 Copenhagen 1 Why use DNSSEC What does it solve? Helps against cache poisoning Identifies DNS lying Enables
More informationAssessing and Improving the Quality of DNSSEC
Assessing and Improving the Quality of DNSSEC Deployment Casey Deccio, Ph.D. Sandia National Laboratories AIMS-4 CAIDA, SDSC, San Diego, CA Feb 9, 2012 Sandia is a multiprogram laboratory operated by Sandia
More informationInternet Engineering Task Force (IETF) Request for Comments: 7706 Category: Informational ISSN: November 2015
Internet Engineering Task Force (IETF) Request for Comments: 7706 Category: Informational ISSN: 2070-1721 W. Kumari Google P. Hoffman ICANN November 2015 Decreasing Access Time to Root Servers by Running
More informationDomain Name System - Advanced Computer Networks
- Advanced Computer Networks Saurabh Barjatiya International Institute Of Information Technology, Hyderabad 26 August, 2011 Contents 1 Distributed database, highly volatile Domain names Top level domains
More informationHarness Your Internet Activity
Harness Your Internet Activity Enabling Efficiency and Service Differentiation Ralf Weber October 13, 2014 Authoritative DNS Proven High-performance Tested with up to 1 Billion resource records per server
More informationBIND 9 Administrator Reference Manual
BIND 9 Administrator Reference Manual November 4, 2005 Copyright c 2004, 2005 Internet Systems Consortium, Inc. ( ISC ) Copyright c 2000, 2001, 2002, 2003 Internet Software Consortium. Chapter 1 Introduction
More informationDNSSEC All You Need To Know To Get Started
DNSSEC All You Need To Know To Get Started Olaf M. Kolkman RIPE NCC A Semi Technical Introduction Why do we need DNSSEC What does DNSSEC provide How does DNSSEC work Question: www.ripe.net A Reminder:
More informationRFC 2181 Ranking data and referrals/glue importance --- new resolver algorithm proposal ---
RFC 2181 Ranking data and referrals/glue importance --- new resolver algorithm proposal --- Kazunori Fujiwara fujiwara@jprs.co.jp Japan Registry Services Co., Ltd (JPRS) DNS-OARC Workshop 2016/10/16 Last
More informationBIG-IP Access Policy Manager : Secure Web Gateway. Version 13.0
BIG-IP Access Policy Manager : Secure Web Gateway Version 13.0 Table of Contents Table of Contents BIG-IP APM Secure Web Gateway Overview...9 About APM Secure Web Gateway... 9 About APM benefits for web
More informationAlgorithm for DNSSEC Trusted Key Rollover
Algorithm for DNSSEC Trusted Key Rollover Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, FRANCE {gilles.guette, bernard.cousin, david.fort}@irisa.fr Abstract.
More informationDNS. dr. C. P. J. Koymans. September 16, Informatics Institute University of Amsterdam. dr. C. P. J. Koymans (UvA) DNS September 16, / 46
DNS dr. C. P. J. Koymans Informatics Institute University of Amsterdam September 16, 2008 dr. C. P. J. Koymans (UvA) DNS September 16, 2008 1 / 46 DNS and BIND DNS (Domain Name System) concepts theory
More informationInternet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice. Parsons November 2016
Internet Engineering Task Force (IETF) Request for Comments: 8027 BCP: 207 Category: Best Current Practice ISSN: 2070-1721 W. Hardaker USC/ISI O. Gudmundsson CloudFlare S. Krishnaswamy Parsons November
More informationDNSSEC Signing Experiences. Michael Sinatra, UC Berkeley Internet2 Member Meeting 3 November 2010
DNSSEC Signing Experiences Michael Sinatra, UC Berkeley Internet2 Member Meeting 3 November 2010 1 Why deploy DNSSEC? DNS has traditionally been an asecure protocol. More applications rely on security--from
More informationISC & DNSco Quarterly Update
ISC & DNSco Quarterly Update 16 October 2013 Welcome! Presentation 45 minutes All attendees are on mute Q&A at the end of this webinar 10 minutes Use WebEx chat window to submit questions In the interest
More informationDNS Security DNSSEC. *http://compsec101.antibo zo.net/papers/dnssec/dnss ec.html. IT352 Network Security Najwa AlGhamdi
DNS Security DNSSEC *http://compsec101.antibo zo.net/papers/dnssec/dnss ec.html 1 IT352 Network Security Najwa AlGhamdi Introduction DNSSEC is a security extensions to the DNS protocol in response to the
More informationAdvanced Caching DNS Server
This chapter explains how to set the Caching DNS parameters for the advanced features of the server. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which
More informationUSING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION
USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION 11-30-2016 USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION Transaction Signatures (TSIG) provide a secure
More informationDomain Name System Security
Slide title 70 pt APITALS Domain Name System Security e subtitle um 30 pt Bengt Sahlin Ericsson Research NomadicLab Bengt.Sahlin@ericsson.com Objectives Provide DNS basics, essential for understanding
More informationI certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist?
RRSIG: I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist? NSEC: I certify that there are no DNS records (of type X) whose record
More informationOpenDNSSEC.com. John Dickinson
John Dickinson A collaboration between Kirei AB John Dickinson.se NLNetlabs Nominet IANA History and Aims Security Modules Hardware Security Modules Software Security Modules KASP The OpenDNSSEC signer
More informationDNSSEC deployment. Phil Regnauld Hervey Allen
DNSSEC deployment Phil Regnauld Hervey Allen Overview We will talk about: the problems that DNSSEC addresses the protocol and implementations the practical problems tied to real-world deployment We will
More informationInternet Engineering Task Force (IETF) Request for Comments: ISSN: K. Fujiwara JPRS December 2015
Internet Engineering Task Force (IETF) Request for Comments: 7719 Category: Informational ISSN: 2070-1721 P. Hoffman ICANN A. Sullivan Dyn K. Fujiwara JPRS December 2015 DNS Terminology Abstract The DNS
More informationcertbot-dns-rfc2136 Documentation
certbot-dns-rfc2136 Documentation Release 0 Certbot Project Aug 29, 2018 Contents: 1 Named Arguments 3 2 Credentials 5 2.1 Sample BIND configuration....................................... 6 3 Examples
More informationDNS Flag day. A tale of five cctlds. Hugo Salgado,.CL Sebastián Castro,.NZ DNS-OARC 29, Amsterdam
DNS Flag day A tale of five cctlds Hugo Salgado,.CL Sebastián Castro,.NZ DNS-OARC 29, Amsterdam 1 What is EDNS? RFC 6891 Defines a backward compatible mechanism to signal support for new DNS options Original
More informationDNSSEC at ORNL. Paige Stafford Joint Techs Conference, Fairbanks July 2011
DNSSEC at ORNL Paige Stafford Joint Techs Conference, Fairbanks July 2011 Outline Background Brief review of DNSSEC ORNL before DNSSEC was implemented Implementation experience Signer appliance Validation
More informationSome advanced topics. Karst Koymans. Tuesday, September 16, 2014
DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 44, 2014/09/15 08:39:47) Tuesday, September 16, 2014 Karst Koymans (UvA) DNS Tuesday, September 16, 2014 1
More informationDomain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot October 2008 Bengt Sahlin 2008/10/02 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
More informationDNS SECurity Extensions technical overview
The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research developed by EURid in cooperation with industry experts
More informationDNS security. Karst Koymans & Niels Sijm. Tuesday, September 18, Informatics Institute University of Amsterdam
DNS security Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Tuesday, September 18, 2012 Karst Koymans & Niels Sijm (UvA) DNS security Tuesday, September 18, 2012 1 / 38 1 Chain
More informationDNS Session 2: DNS cache operation and DNS debugging. Joe Abley AfNOG 2006 workshop
DNS Session 2: DNS cache operation and DNS debugging Joe Abley AfNOG 2006 workshop How caching NS works (1) If we've dealt with this query before recently, answer is already in the cache easy! Resolver
More informationBIND 9.11 Update. August 31, ISC
BIND 9.11 Update August 31, 2016 Presenter Vicky Risk Product Manager BIND Core Team sw eng, team lead sr sw eng sw eng sw eng Evan H. Mark A. Mukund S. Witold K. director of sw eng qa manager qa engineer
More informationDNS. Some advanced topics. Karst Koymans. Informatics Institute University of Amsterdam. (version 17.2, 2017/09/25 12:41:57)
DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 17.2, 2017/09/25 12:41:57) Friday, September 22, 2017 Karst Koymans (UvA) DNS Friday, September 22, 2017 1
More informationUnderstanding and Deploying DNSSEC. Champika Wijayatunga SANOG29 - Pakistan Jan 2017
Understanding and Deploying DNSSEC Champika Wijayatunga SANOG29 - Pakistan Jan 2017 Agenda 1 2 3 Background Why DNSSEC? How it Works? 4 5 Signatures and Key Rollovers DNSSEC Demo 2 3 Background DNS in
More informationRIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
More informationDNSSEC for ISPs workshop.! João Damas
DNSSEC for ISPs workshop!!! João Damas (joao@isc.org) 1 Outline of workshop Brief intro to DNSSEC (30 ) Overview of zone signing (30 ) DNSSEC validation (60 ) trust anchors validation impact of enabling
More informationUpdates: 2535 November 2003 Category: Standards Track
Network Working Group B. Wellington Request for Comments: 3655 O. Gudmundsson Updates: 2535 November 2003 Category: Standards Track Status of this Memo Redefinition of DNS Authenticated Data (AD) bit This
More information3. The DNSSEC Primer. Data Integrity (hashes) Authenticated Denial of Existence (NSEC,
3. The DNSSEC Primer Authentication (keys, signatures) Data Integrity (hashes) Chain of Trust (root zone, when signed) Authenticated Denial of Existence (NSEC, NSEC3) DNS Authoritative ROOT SERVERS TLD
More informationRequest for Comments: 2535 Obsoletes: 2065 March 1999 Updates: 2181, 1035, 1034 Category: Standards Track
Network Working Group D. Eastlake Request for Comments: 2535 IBM Obsoletes: 2065 March 1999 Updates: 2181, 1035, 1034 Category: Standards Track Status of this Memo Domain Name System Security Extensions
More informationGDS Resource Record: Generalization of the Delegation Signer Model
GDS Resource Record: Generalization of the Delegation Signer Model Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, France {gilles.guette, bernard.cousin, david.fort}@irisa.fr
More informationSession J9: DNSSEC and DNS Security
Session J9 and Security InfoSec World 2008 Session J9: and Security Steve Pinkham, Maven Security Consulting What is? slide 2 Easy answer: Stands for Domain Name System System for converting names to/from
More informationA Security Evaluation of DNSSEC with NSEC Review
A Security Evaluation of DNSSEC with NSEC Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being
More informationTable of Contents. DNS security. Alternative DNS security mechanism. DNSSEC specification. The long (and winding) road to the DNSSEC specification
Table of Contents DNS security Karst Koymans Informatics Institute University of Amsterdam (version 1.19, 2011/09/27 14:18:11) Friday, September 23, 2011 The long (and winding) road to the DNSSEC specification
More informationAuthoritative-only server & TSIG
Authoritative-only server & TSIG cctld workshop Apia, Samoa,20 23 June 2006 Andy Linton (Materials by Alain Aina) Different type of servers Several types of name servers Authoritative servers master (primary)
More informationDNS Session 2: DNS cache operation and DNS debugging. How caching NS works (1) What if the answer is not in the cache? How caching NS works (2)
D Session 2: D cache operation and D debugging How caching works (1) If we've dealt with this query before recently, answer is already in the cache - easy! Joe Abley AfNOG 2006 workshop Resolver Query
More informationDNSSEC Validators Requirements
DNSSEC Validators Requirements draft-mglt-dnsop-dnssec-validator-requirements-05 Migault, Lewis, York IETF99 ToC Time Requirements Trust Anchor Requirements Bootstrapping / configuration TA Datastore Interaction
More informationDNS Security. APNIC42 Colombo Sri Lanka 01 October 2016 Champika Wijayatunga
DNS Security APNIC42 Colombo Sri Lanka 01 October 2016 Champika Wijayatunga 2 Brief Overview of DNS What is the Domain Name System? A distributed database primarily used to obtain
More information12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS vulnerability DNS root servers DNSSEC chain of trust DNSSEC
More informationIP Addressing: DNS Configuration Guide
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More informationMeasuring the effects of DNSSEC deployment on query load
Measuring the effects of DNSSEC deployment on query load Jelte Jansen NLnet Labs NLnet Labs document 26-2 May 1, 26 Abstract Ripe NCC recently started signing the zones on their DNS servers. This document
More informationInternet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice ISSN: March 2017
Internet Engineering Task Force (IETF) Request for Comments: 8109 BCP: 209 Category: Best Current Practice ISSN: 2070-1721 P. Koch DENIC eg M. Larson P. Hoffman ICANN March 2017 Initializing a DNS Resolver
More informationManaging Zones. Staged and Synchronous Modes CHAPTER. See Also
CHAPTER 15 Managing Zones The Domain Name System (DNS) is a distributed database for objects in a computer network. By using a nameserver approach, the network consists of a hierarchy of autonomous domains
More informationTable of Contents DNS. Short history of DNS (1) DNS and BIND. Specification and implementation. A short history of DNS.
Table of Contents Specification and implementation DNS dr. C. P. J. Koymans Informatics Institute University of Amsterdam September 14, 2009 A short history of DNS Root servers Basic concepts Delegation
More information